Use of a broken or risky cryptographic algorithm in Red Hat Ceph Storage - CVE-2021-3979

Vulnerability identifier: #VU66551

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3979

CWE-ID: CWE-327

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to Ceph volume does not the honour osd_dmcrypt_key_size, resulting in the key length is being incorrectly passed in an encryption algorithm to create a non random key. An attacker with physical access to encrypted device can decrypt data and gain access to sensitive information.

Red Hat Ceph Storage
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server
openSUSE Leap
Ubuntu
openEuler
Fedora
cephadm-ansible (Red Hat package)
tcmu-runner (Red Hat package)
libntirpc (Red Hat package)
ceph-iscsi (Red Hat package)
nfs-ganesha (Red Hat package)
ceph-ansible (Red Hat package)
python-rsa (Red Hat package)
fmt-debugsource
libfmt8-debuginfo
libfmt8
python-cephfs
python3-ceph-argparse
rados-objclass-devel
librados-devel
python-rados
ceph-selinux
libcephfs-devel
librbd1
ceph-debuginfo
ceph-fuse
libcephfs2
ceph-mgr
ceph-common
ceph-mds
librgw-devel
librados2
python3-rados
python-rbd
ceph-base
ceph
python3-rbd
librbd-devel
rbd-fuse
ceph-test
ceph-mon
ceph-radosgw
ceph-debugsource
rbd-nbd
ceph-resource-agents
python-rgw
librgw2
python-ceph-compat
libradosstriper-devel
rbd-mirror
python3-cephfs
libradosstriper1
ceph-osd
python3-rgw
ceph-common (Ubuntu package)
ceph-base (Ubuntu package)
ceph (Ubuntu package)
ceph (Red Hat package)
ceph-base-debuginfo
cephadm
rbd-nbd-debuginfo
python3-rgw-debuginfo
python3-rbd-debuginfo
python3-rados-debuginfo
python3-cephfs-debuginfo
python3-ceph-common
librgw2-debuginfo
ceph-common-debuginfo
libcephfs2-debuginfo
librados2-debuginfo
librbd1-debuginfo
ceph-mgr-dashboard
libradospp-devel
ceph-mgr-diskprediction-local
ceph-test-debugsource
ceph-test-debuginfo
ceph-prometheus-alerts
ceph-mgr-rook
ceph-mgr-modules-core
ceph-mgr-k8sevents
ceph-mgr-cephadm
ceph-grafana-dashboards
rbd-mirror-debuginfo
rbd-fuse-debuginfo
librados-devel-debuginfo
ceph-fuse-debuginfo
ceph-immutable-object-cache
ceph-immutable-object-cache-debuginfo
ceph-mds-debuginfo
cephfs-shell
ceph-radosgw-debuginfo
ceph-osd-debuginfo
ceph-mon-debuginfo
ceph-mgr-debuginfo
cephfs-top
cephfs-mirror-debuginfo
cephfs-mirror
libcephsqlite
libcephsqlite-debuginfo
libcephsqlite-devel

Install updates from vendor's website.

Red Hat Ceph Storage - addressed in versions 5.1, 4.3
cephadm-ansible (Red Hat package) - update to 0.1-4.g6754c10.el8cp
tcmu-runner (Red Hat package) - addressed in versions 1.5.2-5.el7cp, 1.5.2-5.el8cp, 1.5.4-4.el8cp
libntirpc (Red Hat package) - addressed in versions 3.4-1.1.el7cp, 3.4-1.1.el8cp
ceph-iscsi (Red Hat package) - addressed in versions 3.4-5.el7cp, 3.4-5.el8cp, 3.5-2.el8cp
nfs-ganesha (Red Hat package) - addressed in versions 3.5-1.2.el7cp, 3.5-1.2.el8cp
ceph-ansible (Red Hat package) - addressed in versions 4.0.70.3-1.el7cp, 4.0.70.3-1.el8cp, 6.0.25.4-1.el8cp
python-rsa (Red Hat package) - update to 4.8-1.el8cp
fmt-debugsource - update to 8.0.1-150300.7.5.1
libfmt8-debuginfo - update to 8.0.1-150300.7.5.1
libfmt8 - update to 8.0.1-150300.7.5.1
python-cephfs - update to 12.2.8-20
python3-ceph-argparse - update to 12.2.8-20
rados-objclass-devel - update to 12.2.8-20
librados-devel - update to 12.2.8-20
python-rados - update to 12.2.8-20
ceph-selinux - update to 12.2.8-20
libcephfs-devel - update to 12.2.8-20
librbd1 - update to 12.2.8-20
ceph-debuginfo - update to 12.2.8-20
ceph-fuse - update to 12.2.8-20
libcephfs2 - update to 12.2.8-20
ceph-mgr - update to 12.2.8-20
ceph-common - update to 12.2.8-20
ceph-mds - update to 12.2.8-20
librgw-devel - update to 12.2.8-20
librados2 - update to 12.2.8-20
python3-rados - update to 12.2.8-20
python-rbd - update to 12.2.8-20
ceph-base - update to 12.2.8-20
ceph - update to 12.2.8-20
python3-rbd - update to 12.2.8-20
librbd-devel - update to 12.2.8-20
rbd-fuse - update to 12.2.8-20
ceph-test - update to 12.2.8-20
ceph-mon - update to 12.2.8-20
ceph-radosgw - update to 12.2.8-20
ceph-debugsource - update to 12.2.8-20
rbd-nbd - update to 12.2.8-20
ceph-resource-agents - update to 12.2.8-20
python-rgw - update to 12.2.8-20
librgw2 - update to 12.2.8-20
python-ceph-compat - update to 12.2.8-20
libradosstriper-devel - update to 12.2.8-20
rbd-mirror - update to 12.2.8-20
python3-cephfs - update to 12.2.8-20
libradosstriper1 - update to 12.2.8-20
ceph-osd - update to 12.2.8-20
python3-rgw - update to 12.2.8-20
ceph-common (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3
ceph-base (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3
ceph (Ubuntu package) - addressed in versions 12.2.13-0ubuntu0.18.04.11, 15.2.17-0ubuntu0.20.04.3, 17.2.5-0ubuntu0.22.04.3, 17.2.5-0ubuntu0.22.10.3
ceph (Red Hat package) - addressed in versions 14.2.22-110.el7cp, 14.2.22-110.el8cp, 16.2.7-98.el8cp
ceph-base-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-base - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
cephadm - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
rbd-nbd-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
rbd-nbd - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-rgw-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-rgw - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-rbd-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-rbd - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-rados-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-rados - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-cephfs-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-cephfs - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-ceph-common - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librgw2-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
python3-ceph-argparse - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-common - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-common-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-debugsource - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
libcephfs2 - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
libcephfs2-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librados2 - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librados2-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librbd1 - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librbd1-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librgw2 - addressed in versions 16.2.9.536+g41a9f9a5573-150300.3.3.1, 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
rados-objclass-devel - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librgw-devel - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librbd-devel - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr-dashboard - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
libradospp-devel - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr-diskprediction-local - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-test-debugsource - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-test-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-test - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-prometheus-alerts - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr-rook - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr-modules-core - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr-k8sevents - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
rbd-fuse - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr-cephadm - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-grafana-dashboards - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
rbd-mirror-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
rbd-mirror - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
rbd-fuse-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librados-devel - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
librados-devel-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-fuse - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-fuse-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-immutable-object-cache - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-immutable-object-cache-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mds-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mds - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
libcephfs-devel - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
cephfs-shell - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-radosgw-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-radosgw - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-osd-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-osd - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mon-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mon - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr-debuginfo - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph-mgr - addressed in versions 16.2.9.536+g41a9f9a5573-150300.6.3.1, 16.2.9.536+g41a9f9a5573-150400.3.3.1
cephfs-top - update to 16.2.9.536+g41a9f9a5573-150400.3.3.1
cephfs-mirror-debuginfo - update to 16.2.9.536+g41a9f9a5573-150400.3.3.1
cephfs-mirror - update to 16.2.9.536+g41a9f9a5573-150400.3.3.1
libcephsqlite - update to 16.2.9.536+g41a9f9a5573-150400.3.3.1
libcephsqlite-debuginfo - update to 16.2.9.536+g41a9f9a5573-150400.3.3.1
libcephsqlite-devel - update to 16.2.9.536+g41a9f9a5573-150400.3.3.1
ceph - addressed in versions 17.2.4-1.fc37, 17.2.5-1.fc37

• https://bugzilla.redhat.com/show_bug.cgi?id=2024788
• https://access.redhat.com/errata/RHSA-2022:1174

• SUSE update for ceph
• SUSE update for ceph
• SUSE update for ceph
• Ubuntu update for ceph
• openEuler update for ceph
• Fedora 37 update for ceph
• Fedora 37 update for ceph
• Multiple vulnerabilities in Red Hat Ceph Storage 5
• Multiple vulnerabilities in Red Hat Ceph Storage 4